Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 474Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 19 | 27 | 6 | 0 | 53 | 69 |
| 2025 | 0 | 0 | 1 | 1 | 0 | 2 | 16 |
| 2024 | 0 | 1 | 5 | 0 | 0 | 6 | 14 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 8 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2021 | 0 | 2 | 4 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-115923 | Backstage catalog rules can be bypassed for URL locations using encoded path segmentsbackstage · backstage | Medium6.5 |
| CVE-2026-106495 | Backstage: Improper access control in backend action invocationbackstage · backstage | Medium4.3 |
| CVE-2026-106557 | Backstage: Improper input validation in TechDocs Markdown extension configurationbackstage · backstage | High7.7 |
| CVE-2026-106563 | Backstage: Improper entity validation in deprecated Kubernetes services endpointbackstage · backstage | Medium5.3 |
| CVE-2026-106562 | Backstage: Incorrect authorization in search engine permission filteringbackstage · backstage | Medium4.3 |
| CVE-2026-106561 | Backstage: Sensitive information disclosure in Kubernetes resource queriesbackstage · backstage | Medium5.0 |
| CVE-2026-106560 | Backstage: Improper repository path validation in a Scaffolder backend modulebackstage · backstage | High7.1 |
| CVE-2026-106559 | Backstage: Improper input validation in Confluence to Markdown scaffolder modulebackstage · backstage | Medium6.3 |
| CVE-2026-106558 | Backstage: Improper validation of TechDocs MkDocs configurationbackstage · backstage | High8.8 |
| CVE-2026-106556 | Backstage: Configuration bypass in TechDocs mkdocs.yml sanitizationbackstage · backstage | High7.7 |
| CVE-2026-106510 | Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlbackstage · backstage | High7.7 |
| CVE-2026-106509 | Backstage: Improper validation of MkDocs theme configuration in TechDocsbackstage · backstage | High7.7 |
| CVE-2026-106508 | Backstage: Potential file exposure through local TechDocs publisherbackstage · backstage | Medium5.3 |
| CVE-2026-106507 | Backstage: TechDocs arbitrary file read via mkdocs snippetsbackstage · backstage | Medium5.3 |
| CVE-2026-106506 | Backstage: Improper input validation in scaffolder task list orderingbackstage · backstage | Medium5.3 |
| CVE-2026-106505 | Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backendbackstage · backstage | High7.7 |
| CVE-2026-106504 | Backstage: Sensitive information exposure in scaffolder task logsbackstage · backstage | Medium6.5 |
| CVE-2026-106503 | Backstage: Scaffolder action input authorization bypassbackstage · backstage | High8.1 |
| CVE-2026-106502 | Backstage: Sensitive information may be exposed in Scaffolder task failure eventsbackstage · backstage | Medium5.3 |
| CVE-2026-106501 | Backstage: Sensitive information exposure in Scaffolderbackstage · backstage | Critical9.6 |
| CVE-2026-106500 | Backstage: Improper task state validation in Scaffolder backendbackstage · backstage | High8.5 |
| CVE-2026-106499 | Backstage: Secret-derived values may be exposed in scaffolder task logsbackstage · backstage | Medium4.9 |
| CVE-2026-106498 | Backstage: Improper URL validation in catalog entity placeholder resolutionbackstage · backstage | High7.7 |
| CVE-2026-106497 | Backstage: Inconsistent catalog property permission evaluationbackstage · backstage | Medium4.3 |
| CVE-2026-106496 | Backstage: Inconsistent enforcement of allowed location types during catalog processingbackstage · backstage | Low3.1 |
| CVE-2026-106494 | Backstage: Improper input validation in cloud storage URL readersbackstage · backstage | Medium4.4 |
| CVE-2026-106493 | Backstage: Cloud storage catalog locations may cross configured storage boundariesbackstage · backstage | Low3.0 |
| CVE-2026-106492 | Backstage: Improper preservation of access restrictions during service credential delegationbackstage · backstage | High7.6 |
| CVE-2026-106491 | Backstage: Improper input validation in proxy-backendbackstage · backstage | Medium6.4 |
| CVE-2026-106490 | Backstage: Improper input validation in TechDocs static content requestsbackstage · backstage | Medium6.5 |
| CVE-2026-106489 | Backstage: Improper authorization enforcement for TechDocs static contentbackstage · backstage | Medium6.5 |
| CVE-2026-106488 | Backstage: Improper authentication in the OIDC providerbackstage · backstage | High8.1 |
| CVE-2026-106487 | Backstage: Unsupported catalog cluster authentication mode in kubernetes backendbackstage · backstage | Low3.5 |
| CVE-2026-106486 | Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actionsbackstage · backstage | High8.5 |
| CVE-2026-106463 | Backstage: Improper authorization in GitLab organizational user ingestionbackstage · backstage | Medium5.4 |
| CVE-2026-106462 | Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallbackbackstage · backstage | Medium6.4 |
| CVE-2026-106461 | Backstage: Incorrect authorization in scaffolder task listingbackstage · backstage | Medium4.3 |
| CVE-2026-106460 | Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalizationbackstage · backstage | Medium6.8 |
| CVE-2026-106459 | Backstage: Improper input validation in Sentry scaffolder actionsbackstage · backstage | High8.5 |
| CVE-2026-106458 | Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updatesbackstage · backstage | Medium6.5 |
| CVE-2026-106457 | Backstage: Insufficient audience validation in the Cloudflare Access auth providerbackstage · backstage | Medium6.8 |
| CVE-2026-106456 | Backstage: Inconsistent credential enforcement for overlapping proxy routesbackstage · backstage | Medium4.8 |
| CVE-2026-106455 | Backstage: Improper validation of MkDocs plugin configuration in TechDocsbackstage · backstage | High7.7 |
| CVE-2026-88064 | Backstage: Improper input validation in TechDocs MkDocs configurationbackstage · backstage | High8.8 |
| CVE-2026-73563 | Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass in `@backstage/plugin-auth-backend`backstage · backstage | Medium4.7 |
| CVE-2026-29186 | @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Executionbackstage · backstage | High7.7 |
| CVE-2026-29184 | @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypassbackstage · backstage | Low2.0 |
| CVE-2026-29185 | @backstage/integration: Potential reading of SCM URLs using built in tokenbackstage · backstage | Low2.7 |
| CVE-2026-25152 | @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generatorbackstage · backstage | Medium5.3 |
| CVE-2026-25153 | @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooksbackstage · backstage | High7.7 |